WordPress just conducted a hostile takeover of a popular plugin from WP Engine

WordPress founder Matt Mullenweg just had WordPress conduct a hostile takeover of Advanced Custom Fields (ACF), a popular plugin owned by WP Engine.

This is a big deal. WordPress powers 43% of all websites on the internet. And all of them are at the mercy of a back-and-forth dispute between Mullenweg and the executives running WP Engine.

So what exactly is going on?

“Forking” over the repository

It began with the following X post from the team running ACF. Apparently, they were just as surprised by the latest power move from WordPress as everyone else:

Shortly after this post went live, Mullenweg published a blog post entitled "Secure Custom Fields" explaining that WordPress forked ACF into a new plugin in order to "remove commercial upsells" and "fix a security problem."

The official WordPress account on X — presumably run by Mullenweg himself — summarized the post as follows:

“Invoking point 18 of the plugin directory guidelines, we are introducing Secure Custom Fields (SCF), a free fork and drop-in replacement of the Advanced Custom Fields (ACF) plugin. You can safely uninstall ACF and activate SCF from the #WordPress plugin directory. SCF provides security updates and is a non-commercial plugin welcoming developers to get involved in maintaining and improving it.”

Forking refers to creating a copy of someone else’s project so you can freely modify and experiment with the code without affecting the original repository. Forked code is separate from the original, but it retains a connection that allows you to submit a pull request if you want your changes to be reviewed and potentially merged back into the original project.

But WordPress didn’t fork ACF in this way. In fact, they did what might be called a “reverse fork”: they took over the original ACF project — with its original URL slug, user reviews, forum messages, and more — and only left the ACF team with a copy of the codebase:

Why is this happening?

A few weeks ago we published this explainer laying out the drama between WordPress and WP Engine, but here’s the TL;DR version:

• September 21: Mullenweg published a blog post titled: WP Engine is not WordPress. In the post, Mullenweg called WP Engine a "cancer" to WordPress and demanded that they get a trademark license to continue their business. Obviously this didn’t sit well with WP Engine, so…

• September 23: WP Engine sent a cease and desist letter to Automattic — a for-profit company Mullenweg started for providing commercial services related to WordPress — essentially accusing Mullenweg of extorting WP Engine for large sums of cash. “How much cash,” you ask?

• September 24: Mullenweg admitted on Reddit that WP Engine was asked to pay 8% of their revenue. No small fee, considering WP Engine makes over $400 million a year with their WordPress hosting service.

Things have only escalated in the weeks since.

Earlier this month, 159 of Mullenweg’s employees at Automattic — 8.4% of the company — accepted $30k buy-out offers to leave the company because they disagreed with the direction he was taking the company.

What the people are saying

Yesterday Pieter Levels, a popular solo founder, took to X to weigh in on the WordPress drama.

First he suggested that WordPress users should migrate to Ghost.org, a WordPress competitor. Then he followed up on this suggestion with the following thoughts:

Pains me to tweet this because I'm such a WordPress and Matt Mullenweg fan

But if I wouldn't say it I'd be lying to myself just because I'm such a fan

I'm convinced this entire thing is a personal meltdown and it's not his real character

So I think everyone should migrate back after this saga is over

But right now it's starting to enter dangerous territory where it looks WordPress or Matt really doesn't care if it starts affecting WordPress installations in a bad way which is like 60-70% of the internet

How it should go IMHO is:

• do the court case

• let the judge decide who's wrong or right

• don't make WordPress users the victim of all this drama

• let things run as they were running

• act like a grown up

David Heinemeier Hansson, who created Ruby on Rails and Basecamp, weighed in as well:

In his blog post, DHH claimed to support the “Benevolent Dictator For Life” model for managing open-source projects, but criticized how Automattic, under Mullenweg, had handled the conflict with WP Engine:

“The most recent escalation, and, in my opinion, the most unhinged, is the expropriation of the ACF plugin. Automattic first answered WPE's lawsuit by blocking engineers from the latter from accessing the WordPress.org plugin registry, which is used to distribute updates and security patches. It then used the fact that WPE no longer had access to the registry to expropriate the plugin, including reviews and download stats!! The ACF entry now points to Automattic's own Secure Custom Fields.”